You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Security / iframe (editHTMLDocumentMode, stored XSS, CWE-79): with iframe: true and editHTMLDocumentMode: true a full HTML document assigned to editor.value was written straight into the live iframe document with document.write(), and safeHTML was only applied afterwards. Inline <script> elements and on* handlers therefore executed while the document was being parsed — before the sanitizer could remove them — in an iframe that is same-origin with the host page by default (iframeSandbox: null), so an attacker-supplied document could run script in the host application's origin as soon as another user opened it. The document is now parsed in an inert DOMParser document (no browsing context: nothing executes, no sub-resources are fetched), sanitized there via the safeHTML event, and only then adopted into the live iframe document; nodes coming from an inert parser are flagged "already started", so even a <script> the cleaner is configured to keep never executes — the same guarantee innerHTML gives in the regular mode. A partial value (no <html>/<body>) in that mode was also assigned to doc.body.innerHTML unsanitized before clean-html ran, which fired e.g. <img onerror>; it now goes through the regular sanitized path. Affected all versions with editHTMLDocumentMode through 4.14.5. Responsibly reported by @bp0lr (GHSA-w3xv-x3fm-59ph).
